Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 620 of 1013.
- CVE-2026-45683 OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
- CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
- CVE-2026-45681 OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
- CVE-2026-45680 OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
- CVE-2026-4568 SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection
- CVE-2026-45679 OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
- CVE-2026-45678 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
- CVE-2026-45677 Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS
- CVE-2026-45676 OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
- CVE-2026-45675 Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
- CVE-2026-45674 Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
- CVE-2026-45673 Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
- CVE-2026-45672 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
- CVE-2026-45671 Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
- CVE-2026-45670 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
- CVE-2026-4567 Tenda A15 UploadCfg stack-based overflow
- CVE-2026-45669 Nuxt: Reflected XSS in `navigateTo()` external redirect
- CVE-2026-45668 Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)
- CVE-2026-45667 Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
- CVE-2026-45666 Open WebUI: Indirect Object Reference (IDOR) in user notes
- CVE-2026-45665 Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order
- CVE-2026-45664 ImageMagick: Policy Bypass in MNG coder could
- CVE-2026-45663 Dokploy: Remote Code Execution via destinationPath in Container File Upload
- CVE-2026-45662 Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)
- CVE-2026-45661 Dokploy: Remote Code Execution through Path Traversal
- CVE-2026-45660 Statamic: Server-Side Request Forgery via Glide
- CVE-2026-4566 Belkin F9K1122 formWISP5G stack-based overflow
- CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data
- CVE-2026-45658 Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-45657 Windows Kernel Remote Code Execution Vulnerability
- CVE-2026-45656 UEFI Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-45655 Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-45654 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-45653 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-45650 Microsoft Bing Search Spoofing Vulnerability
- CVE-2026-4565 Tenda AC21 SetNetControlList formSetQosBand buffer overflow
- CVE-2026-45649 Office for Android Spoofing Vulnerability
- CVE-2026-45648 Windows Active Directory Domain Services Remote Code Execution Vulnerability
- CVE-2026-45647 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
- CVE-2026-45646 OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability
- CVE-2026-45645 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-45644 Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability
- CVE-2026-45643 Microsoft Word Remote Code Execution Vulnerability
- CVE-2026-45642 Microsoft Azure Attestation service and Device Health Attestation Service Spoofing Vulnerability
- CVE-2026-45641 Windows Hyper-V Remote Code Execution Vulnerability
- CVE-2026-45640 Windows Bluetooth Port Driver Elevation of Privilege Vulnerability
- CVE-2026-4564 yangzongzhuan RuoYi Quartz Job job code injection
- CVE-2026-45639 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- CVE-2026-45638 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-45637 Microsoft DWM Core Library Elevation of Privilege Vulnerability
- CVE-2026-45636 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-45635 Windows UPnP Device Host Remote Code Execution Vulnerability
- CVE-2026-45634 Windows DHCP Client Information Disclosure Vulnerability
- CVE-2026-45633 Dokploy: Command Injection in /docker-container-logs Endpoint
- CVE-2026-45632 Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution
- CVE-2026-45631 Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret
- CVE-2026-45630 Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement
- CVE-2026-4563 MacCMS Member Order Detail User.php order_info authorization
- CVE-2026-45629 Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint
- CVE-2026-45628 Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline
- CVE-2026-45627 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover
- CVE-2026-45626 Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter
- CVE-2026-45625 Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs
- CVE-2026-45624 ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.
- CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
- CVE-2026-45622 Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id
- CVE-2026-45620 AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration
- CVE-2026-4562 MacCMS Timming API Endpoint Timming.php weak authentication
- CVE-2026-45619 AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
- CVE-2026-45618 LiquidJS is Vulnerable to Remote Code Execution
- CVE-2026-45617 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
- CVE-2026-45616 Vvveb: Stored XSS in Posts allows privilege escalation via post editor
- CVE-2026-45615 mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payload
- CVE-2026-45614 OP-TEE vulnerable to ECDH private key recovery
- CVE-2026-45613 Rizin: Heap-buffer-overflow in OMF parser
- CVE-2026-45612 rz-libdemangle: Out of bound read in rust demangler
- CVE-2026-45610 AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
- CVE-2026-4561 Cross-site scripting in MC4WP: Mailchimp for WordPress
- CVE-2026-45609 mcp-security: Unvalidated URL Fetching (SSRF)
- CVE-2026-45608 Windows DHCP Client Information Disclosure Vulnerability
- CVE-2026-45607 Windows Hyper-V Remote Code Execution Vulnerability
- CVE-2026-45606 Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability
- CVE-2026-45605 Windows Bluetooth Service Elevation of Privilege Vulnerability
- CVE-2026-45604 Windows Managed Installer Information Disclosure Vulnerability
- CVE-2026-45603 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-45602 Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
- CVE-2026-45601 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-45600 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- CVE-2026-45599 Windows UPnP Device Host Remote Code Execution Vulnerability
- CVE-2026-45598 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-45597 Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability
- CVE-2026-45596 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-45595 Windows Mark of the Web Security Feature Bypass Vulnerability
- CVE-2026-45594 Windows Application Identity (AppID) Information Disclosure Vulnerability
- CVE-2026-45593 Windows SDK Elevation of Privilege Vulnerability
- CVE-2026-45592 Windows Internet (wininet.dll) Elevation of Privilege Vulnerability
- CVE-2026-45591 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-4559 Cross-site scripting in Image Photo Gallery Final Tiles Grid
- CVE-2026-45588 Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-45586 Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability